EUVD-2026-60205Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
Credentials are ignored by design so PR:N and AC:L; acting on another tenant's VMs makes S:C, with VM power control (A:H) and CD-mount tampering (I:L) but no direct data disclosure (C:N).
Primary rating from Vendor (74b3a70d-cca6-4d34-9789-e83b222ae3be).
CVSS VectorVendor: 74b3a70d-cca6-4d34-9789-e83b222ae3be
Lifecycle Timeline
2DescriptionCVE.org
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.
AnalysisAI
Authentication bypass in FakeFish (openshift-metal3/fakefish), a Redfish BMC emulator used to bridge metal3/Ironic provisioning to KubeVirt virtual machines, lets any authenticated cluster user manage VMs they do not own. Because FakeFish forwards inbound Redfish credentials to backend scripts but the KubeVirt backend authenticates via a mounted KUBECONFIG and ignores those credentials entirely, no meaningful authorization occurs; an attacker can power target VMs on and off and mount arbitrary virtual CD/ISO images. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that FakeFish is deployed in its KubeVirt backend mode (not driving real hardware BMCs), where it authenticates to KubeVirt via a mounted KUBECONFIG and ignores inbound Redfish credentials; and that the attacker can reach the FakeFish Redfish endpoint over the network as a cluster user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent and point to a genuine, easily exploitable authorization flaw rather than a merely high-scoring paper risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H, base 9.3) reflects network reachability, low complexity, no privileges, no user interaction, and a scope change because the caller acts on another tenant's VMs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (commit-referenced); a released patched version is not independently confirmed from the provided data - versions are expressed only as commit 28f9a6b, so upgrade FakeFish to a build that includes the fix committed after 28f9a6b as described in advisory GHSA-qpfr-jqjq-v83w (https://github.com/openshift-metal3/fakefish/security/advisories/GHSA-qpfr-jqjq-v83w). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of FakeFish in your environment and segment network access to restrict exposure to trusted administrative networks only; disable FakeFish entirely if non-essential to current operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today